monitoring blocked IPs on NSG

Question

Hello,

we've set up NSG to block all traffic (except some white-listed IP ranges) to our Kubernetes services, but now we would like to monitor what IPs are being blocked. Is there any way to see what kind of traffic is incoming and getting blocked? Is it logged somewhere? Just to audit the blocked IPs, so we can see if some IP is blocked by our mistake and should be allowed instead.

Thanks for any help!

Answer 1

Hi @Jonesy Cat
NSG Flow logs should show the IP address and port of the client on inbound traffic.
Network security group (NSG) flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG. Flow data is sent to Azure Storage accounts from where you can access it as well as export it to any visualization tool, SIEM, or IDS of your choice.

NSG Flow Log Common use Cases:
Network Monitoring
Usage monitoring and optimization
Compliance
Network forensics & Security analysis

Enabling NSG Flow Logs

If the Answer is helpful, please click **Accept Answer** and up-vote, this can be beneficial to other community members.